Continuous AWS Config Recording in Non-Production Environments

Jérémy Nancel

Service Category

Other

Cloud Provider

AWS

Service Name

AWS Config

Inefficiency Type

Excessive Recording Frequency

Explanation

By default, AWS Config is enabled in continuous recording mode. While this may be justified for production workloads where detailed auditability is critical, it is rarely necessary in non-production environments. Frequent changes in development or testing environments — such as redeploying Lambda functions, ECS tasks, or EC2 instances — generate large volumes of CIRs. This results in disproportionately high costs with minimal benefit to governance or compliance. Switching non-production environments to daily recording reduces CIR volume significantly while maintaining sufficient visibility for tracking changes.

Relevant Billing Model

AWS Config charges per Configuration Item Recorded (CIR). Continuous mode generates a CIR for every resource change, while daily mode generates a maximum of one CIR per resource per day. In non-production environments with frequent deployments or updates, continuous mode creates unnecessary cost without meaningful compliance value.

Detection

Review whether AWS Config is set to continuous recording in non-production accounts or environments
Evaluate change frequency in development, QA, and staging systems to estimate unnecessary CIR volume
Confirm whether governance or compliance requirements justify continuous recording in these environments
Assess consistency of recording settings across production vs. non-production accounts

Remediation

Update AWS Config settings in non-production accounts to daily recording frequency instead of continuous
Apply environment-specific configuration baselines to enforce lower granularity tracking outside of production
Validate that compliance and auditing needs remain satisfied after reducing recording frequency

Relevant Documentation

Submit Feedback